syssec_red_book

13.3. What Is Expected to Happen?(vulnerable) application (e.g., a browser) running within a certain processspace, from being exploited to execute malicious code. In this security model,the role of social engineering and phishing becomes paramount, because theattacker model changes completely: the attacker is able to compromise a deviceonly by managing to have a malicious application executed with the correctprivileges. In the last 2 years, we have indeed witnessed numerous cases ofmobile malware campaigns (see also Chapter 8), in which users were fooledusing classic social-engineering techniques (e.g., email attachments, maliciousapplications disguised as legitimate software through official and unofficialmarketplaces). In this evolving computing landscape, where powerful, expensivehosts shared by many users are giving way to powerful, inexpensivedevices owned by a single user, we expect that social engineering techniqueswill be utilized more than in the past.Given the prevalence of portable computers and mobile phones, the offendershave also been exploiting the voice channel in phishing campaigns.Although classic, this luring scheme has recently been gaining more attention[135, 264, 266]. Typically, the phishers contact their victims, via live telephonecalls, automated responders, or SMS [148], and attempt to trick theminto revealing sensitive information, performing some action (e.g., to unlockor repair their computers), or placing a payment for some expired (bogus)insurance. Albeit simple, this attack scheme is effective where other means fail:indeed, a live conversation enhances the effectiveness of social engineeringtechniques significantly. This does not happen normally with e-mailing becausethe e-mails have to be read, which decreases the chances of the attackerssuccessfully luring the victims. A recent study also noticed a variation ofthis scheme, which is arguably more effective, where victims are lured intocontacting the phishers through telephone numbers spread via social network’smessaging systems (e.g., Twitter [164]).Another interesting, yet dangerous, expected scenario is the significantspread of attacks that affect mobile payment and banking systems. In thesesystems, the mobile device, and thus its owner, becomes a much more sensitivetarget than in the classic PC-based banking operations. First, the usabilityof mobile apps guarantees a larger user base of payment systems. Second,trojans were among the first type of malicious software to be ported to mobileplatforms, including ZitMo and SpitMo [120] (i.e., variants of ZeuS and SpyEyefor Android). Notably, this scenario also creates complex attack venues suchas the case were mobile devices are used as authorization tokens for financialtransactions initiated from, for instance, a traditional web application.In conclusion, what we expect is a less steeply increasing trend in traditional,email-based phishing than in the past. Traditional phishing will arguablygive ground to heterogeneous (e.g., voice, social networks, SMS) phishingcampaigns where social engineering will play a significant role, also thanks95